Basically yes it’s feasible as you wrote it.
I would first try least complicated setup as possible (smallest number of chain links) . You wrote you are using Tailscale you should be able to use it’s exit node mode and transfer (proxy) all your connection to your home server. This should be transparent enough that MC will see all traffic just as on your VPS.
On VPS somehing like (after test make sure all rules are persistent)
tailscale up --advertise-exit-node
# approve exit node in the admin console
sysctl -w net.ipv4.ip_forward=1
# DNAT mail ports to the home node's Tailscale IP (100.x.y.z)
for p in 25 465 587 993 995 4190 **ADD_ALL_YOU_NEED**; do
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $p -j DNAT --to-destination 100.x.y.z
done
In your homelab
tailscale up --exit-node=<vps-tailscale-ip> --exit-node-allow-lan-access
Everything the home server sends now egresses via the VPS and gets masqueraded to the VPS public IP by Tailscale’s own NAT rules. SPF/PTR/HELO all behave as before, no smtp_bind_address fiddling needed.
Possible issues:
1) All or nothing situaltion. So everything from your homelab host is exited via this VPS. If you need more precision of what should exit where you would need to use Wireguard for this instead of Tailscale.
2) ACL. Inspect your Tailscale ACL, already saw some tighten setups that would prevent this behavior silently,…
3) Exit node. As it’s node tells it’s purpose is for outbound traffic. In this setup inbound connections via exit node should work, but Tailscale could update it’s NAT/filter behavior and this could break your setup (you can try Wireguard instead, should simple as this)
4) MTU. This is the most tricky part (same as if you would use Wireguard). Tailscale use 1280 (think) should be safe, but worth testing both small and large mails. Basically problem is that tunnel need to wrap packet in UDP+encryption so the inner MTU must be smaller than physical to fit there.